Npm · Axios · CVE-2026-67315
**Name of the Vulnerable Software and Affected Versions**
axios versions 0.31.0 through 0.32.x
axios versions 1.15.0 through 1.17.x
**Description**
In Node.js applications using the HTTP adapter, the software fails to recognize `0.0.0.0` as a loopback address within the `shouldBypassProxy()` function located in `lib/helpers/shouldBypassProxy.js`. This occurs because the `isLoopback()` function does not include `0.0.0.0` in its validation logic, causing requests to this address to ignore `NO PROXY` rules (such as `localhost` or `127.0.0.1`). Consequently, if an attacker can influence the request URL or a redirect target, they can route requests through configured proxies to reach local services, potentially bypassing SSRF filtering and exposing internal admin panels or microservice APIs.
**Recommendations**
Update axios to version 0.33.0 or later.
Update axios to version 1.18.0 or later.
As a temporary workaround, explicitly add `0.0.0.0` to the `NO PROXY` environment variable.
As a temporary workaround, set `proxy: false` in the axios request configuration for requests that must not use environment proxies.
As a temporary workaround, normalize or reject `0.0.0.0` in application URL validation before passing it to axios.
Configure the used proxy to reject requests to `0.0.0.0`, loopback, link-local, and internal address ranges.